numberseventeen

how to hack SIPS web application ???

first, you must open the web application it self.
in this case you know the IP address of web server,
you start with firs step, Information gathering.
you can use nmap to find data about web that IP address. you will know what port and application running in OS target.

after you know about server use nmap.
you must know about web application,
you must try any menu in there.
you will know about vulner that web application, like sql injection, xss etc.

after you know about SE and VA, the next step you try infiltrate to the web application server
to do that, you must log in to one of web application user. you dan log in as member or admin .
in this case, i will show you to log in use sql injection vulnerbility.

to use sql command injection you must intercept data packet from users to server.
you must start buro suit and run intercept in proxy.
dont forget to activate your proxy in webrowser.
if you already get the data packet yhrough intercept, next you must save it in file.

go to terminal, type sqlmap command to hack their database.

sqlmap -l (file name of data packet)

tools are running to scan vulnerabilty from database through parameter their had.
if paraneter was inject. you can see current database in there

sqlmap -l (file name) --current-db

after you know that database which running now is "sips"
next step you should see the table inside "sips" database...

sqlmap -l (file name) -D sips -- tables


you will see the table like beside

next step, you must find the users and password to log in as users.
in that table you can see there are 2 tables about acount.
member account and admin account.

for example, you will log in as admin.
you must find the account in pegawai table

sqlmap -l (file name) -D sips -T pegawai --dump

now, you know account of pegawai.

you can log in as pegawai through type the username and password that list in the table

same if you want to log in as a member, you find anggota account in sips database.

sqlmap -l (file name) -D sips -T anggota --dump

then you type type the username and password that list in the table

after you log in as a member. you gathering information about member page.
what running application and that vulnerability.
maybe you will find command execution, upload, xss etc.
in this case, we will atack target from upload, because there are find upload menu.

we must check what thing that can we upload before.
we get information that format jpeg only which can be upload.
we generate backdoor with weevely in jpeg file format.

weevely generate 1234 (file name).jpeg

we upload the file, before we click upload.
we start intercept in burp suit. why?
because we must still send the backdoor in file format php.
if in jpeg format the backdoor can not operate.
before the data packet was accept in server. we change the file format to php, then forward that data packet

upload was succed

then you must find the location of picture upload in web server, we can know from notification that show when we upload the picture. other ways, we right click picture in one of page, show picture information or address.




weevely http://192.168.1.112/perpustakaan/images/(file name.jpeg 1234

and you already come to webserver target in /var/www/ data.

find the account data like username and password as a administrator.

we can ussually find them in the file that name related about index.php or connection,php.

because index.php ussualy use to give name for first page of web application that include log in page

or connection php because you know from the name, file that include user name and password to connect to server

you can use the usrname and password to previllage excallation to root through ssh command in terminal.

but, because the task is to find where the rahasia.txt file was.

you just to find them with cd and ls command to know the file location

thanx 4 ur attention....good luck